VACL or SPAN persistant captures from performance perspective?

geoff.porter — Thu, 07 Mar 2019 10:08:09 GMT

Is there a recommendation or preference to performing persistant packet captures on the Cat6509 and Cat4948 platforms in regards to VACLs vs. SPANs?

We're interesting in capturing ALL TRAFFIC on some heavily utilized switches.

From a performance perspective, is one better on the system resources than the other?

thanks in advanced,

Geoff

VACL or SPAN persistant captures from performance perspective?

Richard Michael — Fri, 09 Sep 2011 18:01:14 GMT

Hello Geoff,

Please find the difference between SPAN and VACL capture.

SPAN:

1) Limited number of SPAN ports/switch (varies based on platform).

2) If you're using TCP Resets (not recommended!) some switch platforms do not allow incoming packets on a SPAN destination port (port connected to the IDS sensor).

3) Supported on most switch platforms.

3) Copies ALL packets from source VLANS or ports to a destination port.

VACL Capture:

1) Unlimited number of capture ports.

2) Copies filtered packets from source VLANS to a destination port (this allows you to get very granular in the type of traffic (e.g. only web traffic) that you want to capture/monitor via IDS.

3) Offloads processing from Supervisor engine to the Policy Feature Card (PFC), which is required to use this feature in 6500.

4) Can be applied to all packets, whether routed or switched, and can be configured on any VLAN.

Some useful links shown below,

https://supportforums.cisco.com/docs/DOC-4455

https://supportforums.cisco.com/message/619352#619352

Thanks,

Ricky Micky

*Pls rate useful posts

tema VACL or SPAN persistant captures from performance perspective? en Switching

VACL or SPAN persistant captures from performance perspective?

VACL or SPAN persistant captures from performance perspective?